While in this collective pipe dream, why not just make it a felony to have unauthorized possession or transmission of this data, make sentencing gravity based on attributes like unsecured, breached, willfully sold, etc?